EEVblog #1144 - Padauk Programmer Reverse Engineering

[serisman]

I have created a PR [1] that introduces a new design for https://free-pdk.github.io/ and also integrates the pinout diagrams as well as an overview of the many different free-pdk repositories. There is a lot of room for further improvements, but this should get the ball rolling when it comes to tutorials and more detailed instructions. Adding pages is as easy as adding new markdown files (no more HTML ).
I have not yet added any information on the SDCC examples and headers, since that is an ongoing discussion.

[1] https://github.com/free-pdk/free-pdk.github.io/pull/3

https://free-pdk.github.io/

It's live now, thanks a lot!

Now it's much easier to contribute some much needed documentation. Everyone, feel free to contribute. You can directly submit pull-requests here: https://github.com/free-pdk/free-pdk.github.io/tree/development

I will add a section about ordering the lite-programmer once I received and validated the r1 samples - they are being made right now.

Excellent!  Nice work!

A few things I noticed while playing around with the pinout diagrams:

• It would be nice if the diagrams were centered on the page.
• Maybe provide a quick way to check/uncheck all.
• For the 'Programming Pins', instead of RESET, maybe use ICVPP like it is labeled on the programmer schematic.  And maybe add an associated ICVDD on the VDD pin to help clarify that it is directly manipulated during programming.
  • PR submitted: https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/3
• I can help explain the datasheet for current sink/drive if needed.  What actual questions do you have?
  • PR submitted: https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/4

I also just submitted PRs for:

• Slightly better consistency with descriptions - https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/5
• Add support for PMS152 - https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/6
• Add support for PMS150C/PMS15A - https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/7

[tim_]

Just as a side note: How can the PMS150C be so cheap?

The image below shows a die size comparison between a PIC12C508 (sorry, wrong title) and a PMS150C. I don't know the actual dimension of the PIC die - the image is from Zeptobars.
One can, however, use the size of the bondbands to scale the images relative to each other. The PMS150C is around 10x smaller than the PIC, thanks to newer technology.

Edit: Source of the images

- PIC: https://zeptobars.com/en/read/PIC12C508-PIC-Microchip
- Padauk: https://electronupdate.blogspot.com/2019/09/3-cent-microprocessor-teardow-paduak.html

[serisman]

From the 'new' website:

SDCC Integration

Padauk themselves use a custom programming language that looks a bit like C for programming the µCs that is compiled by their proprietary IDE. While code created using this custom language can be programmed using the Easy PDK Programmer, we still recommend using SDCC, especially if you want support for proper C code. Should you be interested in code samples in that custom language, look at free-pdk/simple-pdk-code-examples.

That highlighted part is actually incorrect.

Here is a PR to fix that: https://github.com/free-pdk/free-pdk.github.io/pull/8

I also submitted a PR to add ROM and RAM sizes: https://github.com/free-pdk/free-pdk.github.io/pull/6
We might want to turn that section into a table and have columns for the major peripherals (i.e. Instruction Set, ROM Size/Type, RAM Size, ADC, PWM, etc...)

[cmfcmf]

I have created a PR [1] that introduces a new design for https://free-pdk.github.io/ and also integrates the pinout diagrams as well as an overview of the many different free-pdk repositories. There is a lot of room for further improvements, but this should get the ball rolling when it comes to tutorials and more detailed instructions. Adding pages is as easy as adding new markdown files (no more HTML ).
I have not yet added any information on the SDCC examples and headers, since that is an ongoing discussion.

[1] https://github.com/free-pdk/free-pdk.github.io/pull/3

https://free-pdk.github.io/

It's live now, thanks a lot!

Now it's much easier to contribute some much needed documentation. Everyone, feel free to contribute. You can directly submit pull-requests here: https://github.com/free-pdk/free-pdk.github.io/tree/development

I will add a section about ordering the lite-programmer once I received and validated the r1 samples - they are being made right now.

Excellent!  Nice work!

A few things I noticed while playing around with the pinout diagrams:

• It would be nice if the diagrams were centered on the page.
• Maybe provide a quick way to check/uncheck all.
• For the 'Programming Pins', instead of RESET, maybe use ICVPP like it is labeled on the programmer schematic.  And maybe add an associated ICVDD on the VDD pin to help clarify that it is directly manipulated during programming.
  • PR submitted: https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/3
• I can help explain the datasheet for current sink/drive if needed.  What actual questions do you have?
  • PR submitted: https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/4

I also just submitted PRs for:

• Slightly better consistency with descriptions - https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/5
• Add support for PMS152 - https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/6
• Add support for PMS150C/PMS15A - https://github.com/cmfcmf/ic-pinout-diagram-generator/pull/7

Nice work with the PRs.

My confusion with the drive/sink currents in the PFS154 datasheet arose from the fact that it listed the drive/sink currents differently than the PFS173 datasheet:

PFS154	PFS173
"negative drive current", e.g. -5mA	"positive drive current, e.g. 5mA
"low" vs. "normal" current	"normal" vs. "strong" current

But, looking at your PR, I gathered that both seem to mean the same thing.

Centering the diagrams is on my TODO list, however it currently breaks the image download buttons.

[serisman]

My confusion with the drive/sink currents in the PFS154 datasheet arose from the fact that it listed the drive/sink currents differently than the PFS173 datasheet:

PFS154	PFS173
"negative drive current", e.g. -5mA	"positive drive current, e.g. 5mA
"low" vs. "normal" current	"normal" vs. "strong" current

But, looking at your PR, I gathered that both seem to mean the same thing.

Yeah, I'm not sure why they state drive current as '-' in some datasheets but not others.

The low/normal vs. normal/strong has to do with the FUSE settings.  Some have an option to enable weaker IO drive, some have an option to enable stronger IO drive.

Centering the diagrams is on my TODO list, however it currently breaks the image download buttons.

   I took a quick look, but noticed these diagrams use html tables with varying width columns, so I gave up pretty quick.  Hopefully there is a clean way to do it.

EDIT:  Maybe the table can span diagrams instead of creating a new table per diagram?  Then, the column widths would line up between diagrams, and the entire table could be centered.  Not sure what that does to the image download though.

[serisman]

Sharing this here, in case anyone else would find it useful:

I threw together a quick-n-dirty node.js app that can 'rip' the Padauk IDE's .INC files into a more consumable .json form:
And, I used it to 'rip' the PDK .INC files for a bunch of the common devices that we are working with (all the .json files in the root of the repo).

https://github.com/serisman/pdk-device-json

Among other things, this should come in handy for auto-generating the pdk-include files, whenever we decide on the final format.

It also could come in handy to auto-generate documentation, or comparison tables, or just to manually compare two different devices through a compare tool, or whatever.

[NickE]

In this description there is a mistake at STT16 M | LDT16 M | IDXM M,A | IDXM A,M instructions:
https://free-pdk.github.io/PADAUK_FPPA_14_bit_instruction_set.html

000011c<7-bit MEM addr>c  // 7+7+1=15 bit, but this is only 14 bit device

[LovelyA72]

When will the Mini-pill programmer's kicad file available? It'll be fun to build one because it's such an impressive design!

[serisman]

When will the Mini-pill programmer available? It'll be fun to build one because it's such an impressive design!

Thanks for showing interest!  Indeed, it is a kinda fun build to do!  Probably not a good project from someone that hasn't already done some surface mount soldering before, though.  The STM32 in particular can be a bit more challenging than other parts.

The STM32 mini-pill board is already 'available':

• https://hackaday.io/project/173350-stm32-mini-pill
• https://github.com/serisman/stm32-mini-pill
• https://oshpark.com/shared_projects/8USgL5pT

I still have to post the design files for the Padauk programmer top-hat, but the PCBs are already available from OSHPARK (https://oshpark.com/shared_projects/z5EAm6HO).  Or you can find the gerber files from my very first post (https://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering/msg3091725/#msg3091725).

[LovelyA72]

Since all of these padauk micros are surface mounted, I learned quite a lot of surface mounting soldering during the last two months.

[serisman]

Since all of these padauk micros are surface mounted, I learned quite a lot of surface mounting soldering during the last two months.

Excellent! 

Although an LQFP-48 is quite a bit more difficult than a SOP-16.  But, definitely give it a try.  With a decent soldering iron, and some patience, it is fairly manageable.  Some good flux, de-soldering braid, and a magnifying lens will come in handy as well.

Just don't do what I did on the first one.  After carefully tacking down the first corner and repositioning the board so I could tack down the second corner, my OCD got the better of me and without thinking about it, I put my finger on the STM32 to 'clean' off the flux residue.  Let's just say, the pins were never straight again.    I still might be able to fix it, but it was easier/quicker to just grab a spare pcb/ic and try again, this time even more carefullly.

So, maybe a good idea to make sure you have a spare STM32 as well.

[serisman]

Just don't do what I did on the first one.  After carefully tacking down the first corner and repositioning the board so I could tack down the second corner, my OCD got the better of me and without thinking about it, I put my finger on the STM32 to 'clean' off the flux residue.  Let's just say, the pins were never straight again.    I still might be able to fix it, but it was easier/quicker to just grab a spare pcb/ic and try again, this time even more carefullly.

Ok, boo-boo all fixed.  I was able to pull off the IC with hot air, VERY carefully straighten out the bent pins, and tack it back on with hot air again.  I went around and flooded all the pins with solder, and used wick to pull the excess back off.  Some of the pins are still a little out of shape, but as far as I can tell they are all making contact and no shorts (I did clean up the joints a bit further after taking the 'After' picture).  I finished assembly of the rest of the board and can at least confirm that the USB bootloader works.

Before:


After:

[js_12345678_55AA]

Hi,

I created a new showcase repository which will receive complete and useful projects:

https://github.com/free-pdk/easy-pdk-showcase-projects

I spent some time to also create pc emulation code which uses the same (main) source code for emulation. This should make modifications / implementing new features much easier.

All projects are fully self contained and do not have any external dependencies. You only need to install the latest SDCC compiler and you are ready to go.

Projects so far:

* WS2812b RGB LED 16x16 matrix animation demo (inspired from here: https://github.com/joshgerdes/arduino-led-matrix):

https://github.com/free-pdk/easy-pdk-showcase-projects/tree/master/ws2812animation16x16

- universal WS2812B output routine (adopted from cpldcpu's implementation)
- on the fly RLE image decoder
- image packer which compresses the 16x16 RGB images to palette based RLE encoded images (compression factor 15:1)
  The original project for Arduino nano produced apx. 40kB of code. The compressed image version for PADAUK MCUs requires less than 2.5kB.
- the complete project fits into 3K ICs like the PFS173. Reduced versions for 2K and 1K ICs are created automatically (some images/animations left out).
- targets for PMS150C, PFS154, PFS172, PFS173
- emulation project for pc (Linux/MacOS/Windows) - have a look in the emulation directory


* Polyphonic sound player emulating the 4 NES sound and playing a famous tune (ported from: https://bisqwit.iki.fi/jutut/kuvat/programming_examples/pic/):

https://github.com/free-pdk/easy-pdk-showcase-projects/tree/master/polysound

- stand alone 4 channel NES style music player (requires no extra hardware other than a speaker)
- requires 3K IC like PFS173
- emulation project for pc (Linux/MacOS/Windows) - have a look in the emulation directory

More to come soon 

WS2812 16x16 matrix demo:


JS

[js_12345678_55AA]

In this description there is a mistake at STT16 M | LDT16 M | IDXM M,A | IDXM A,M instructions:
https://free-pdk.github.io/PADAUK_FPPA_14_bit_instruction_set.html

000011c<7-bit MEM addr>c  // 7+7+1=15 bit, but this is only 14 bit device

This is a bit tricky to explain...

The "7 bit memory address" label is correct, just the last bit is ignored and reused as "c".

This means the address is 7 bit with the last bit set to 0 (You only can address every second byte).

I tried to explain this in the comment for the instructions: "(last bit of M set to 0, M must be word aligned)"

JS

[ali_asadzadeh]

Thanks for sharing JS

[serisman]

Thanks for sharing JS

Yes, agreed!

That polysound example is simply amazing.

I may have to pick up one of those 16x16 WS2812B matrix displays as well, cause that other project looks like fun too.

Both of these projects make me wonder how easy it would be to combine them with an inexpensive NOR flash IC (i.e. W25Q80 or similar) to greatly increase the quantity/duration of the sounds/patterns and allow them to be changed even without having to re-compile.

[serisman]

FYI,

I cleaned up some of the code and comments in the (in-progress) free-pdk-examples repo (https://github.com/free-pdk/free-pdk-examples) and added README files to the first three examples.

The repo is now also more self-sufficient (it has copies of all the required include files instead of using git submodules).

More to come over the next few days.

I still need to give the repo a proper license, make sure all 'original authors' are properly referenced, clean up the serial code a bit, add more README files, and write the rest of the intended examples.

[js_12345678_55AA]

Both of these projects make me wonder how easy it would be to combine them with an inexpensive NOR flash IC (i.e. W25Q80 or similar) to greatly increase the quantity/duration of the sounds/patterns and allow them to be changed even without having to re-compile.

I already completed a project with external SPI flash - a good quality audio player (plays 8 bit @32kHz).
I created a PCB which holds an 8 pin PADAUK (e.g. PMS150C/PFS154/PFS173) and added a 16MBit SPI flash and a small class D amplifier.
I use it inside of my hackintosh to play the startup chime immediately after a power cycle. 

In order to release this project I still need to write the pc emulation part (not so hard now since I got perfect audio emulation working in polysound already).

I also added a microSD card socket to the PCB mentioned above and want to try to use this as external storage (most likely without file system since we simply don't have enough memory).

JS

[tim_]

Thanks to @cmfcmf we now have a list of community projects on https://free-pdk.github.io/ (scroll to bottom). (Thanks again!)



The list is automatically populated by a Github search. To be included, please do the following:

 - Add "padauk" as a topic for your repository
 - Add a project description

[ali_asadzadeh]

already completed a project with external SPI flash - a good quality audio player (plays 8 bit @32kHz).
I created a PCB which holds an 8 pin PADAUK (e.g. PMS150C/PFS154/PFS173) and added a 16MBit SPI flash and a small class D amplifier.
I use it inside of my hackintosh to play the startup chime immediately after a power cycle. 

A video Demo of some sort would be very nice

[NickE]

Thanks.

Another confusing instructions are T0SN M.n | T1SN M.n | SET0 M.n | SET1 M.n. The table shows 6-bit MEM addr, but for M address you need 7 bit address to be able to address the whole memory. (128bytes PFS154) For IO space needs 6 bit because it is only 64bytes.

I wrote a pure assembler, finished now, testing is in progress. That's why I need to know how every instruction works.

[js_12345678_55AA]

Thanks.

Another confusing instructions are T0SN M.n | T1SN M.n | SET0 M.n | SET1 M.n. The table shows 6-bit MEM addr, but for M address you need 7 bit address to be able to address the whole memory. (128bytes PFS154) For IO space needs 6 bit because it is only 64bytes.

I wrote a pure assembler, finished now, testing is in progress. That's why I need to know how every instruction works.

This is also correct and is indeed a limitation of the processor. Those instructions only can address the lower address space. It's also mentioned in the data sheets.

JS

[js_12345678_55AA]

The audio player showcase project is available now: https://github.com/free-pdk/easy-pdk-showcase-projects/tree/master/audioplayer

A video Demo of some sort would be very nice

What kind of video demo? A video from my hackintosh (intel NUC) starting up?


JS

[NickE]

I experiance so many strange things around this MCU

I run my PFS154 on ILRC but according to my calculation it runs approx. at 143kHz. I wrote a loop with 97nop + 1 goto + 1 xor (to invert led), that's 100 instruction, the execution of the 100 instruction takes 700us, so to execute 1 instruction takes 7us. I don't find any explanation for this. According to the datasheet it should run at 55kHz. I know ILRC is not accurate but I did not expect 143kHz.

Code: [Select]

.rom
wdreset
set0  clkmd.1
set1 pac.0
mov a,#01h
label1:
xor   pa,a
nop
nop
        ...
        97 nops total
        goto label1


[spth]

I experiance so many strange things around this MCU

I run my PFS154 on ILRC but according to my calculation it runs approx. at 143kHz. I wrote a loop with 97nop + 1 goto + 1 xor (to invert led), that's 100 instruction, the execution of the 100 instruction takes 700us, so to execute 1 instruction takes 7us. I don't find any explanation for this. According to the datasheet it should run at 55kHz. I know ILRC is not accurate but I did not expect 143kHz.

Did you properly setup ILRC using the factory calibration value?

Philipp